CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-28214
https://notcve.org/view.php?id=CVE-2020-28214
11 Dec 2020 — A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide. Una CWE-760: Una vulnerabilidad de un Uso de Hash Unidireccional con una Sal Predecible se presenta en Modicon M221 (todas las referencias, todas las versiones), que podría permitir a un ata... • https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04 • CWE-760: Use of a One-Way Hash with a Predictable Salt •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7568
https://notcve.org/view.php?id=CVE-2020-7568
19 Nov 2020 — A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. CWE-200: Se presenta una vulnerabilidad Exposición de Información Confidencial a un Actor No Autorizado en Modicon M221 (todas las referencias, todas las versiones) que podría permitir una divulgación de... • https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7567
https://notcve.org/view.php?id=CVE-2020-7567
19 Nov 2020 — A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys. CWE-311: Se presenta una vulnerabilidad Falta Cifrado de Datos Confidenciales en Modicon M221 (todas las referencias, todas las versiones) que podría permitir al atacante encontrar el hash de c... • https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7566
https://notcve.org/view.php?id=CVE-2020-7566
19 Nov 2020 — A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. CWE-334: Se presenta una vulnerabilidad de Espación Pequeño de Valores Aleatorios ??en Modicon M221 (todas las referencias, todas las versiones) que podría permitir al atacante romper las claves de cifrado cuando el atacante ha ... • https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04 • CWE-334: Small Space of Random Values •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2020-7565
https://notcve.org/view.php?id=CVE-2020-7565
19 Nov 2020 — A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller. CWE-326: Se presenta una vulnerabilidad de Fortaleza de Cifrado Inadecuada en Modicon M221 (todas las referencias, todas las versiones) que podría permitir al atacante romper la clave de cifrado cuando el atacante haya capturad... • https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04 • CWE-326: Inadequate Encryption Strength •
CVSS: 9.8EPSS: 0%CPEs: 8EXPL: 0CVE-2020-7489
https://notcve.org/view.php?id=CVE-2020-7489
22 Apr 2020 — A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller. A CWE-74: Hay una vulnerabilidad de Neutralización Inapropiada de Elementos Especiales en una Salida Utilizada por un Componente Descendente ('Inject... • https://www.se.com/ww/en/download/document/SEVD-2020-105-01 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.2EPSS: 0%CPEs: 24EXPL: 0CVE-2019-6820
https://notcve.org/view.php?id=CVE-2019-6820
22 May 2019 — A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2 Una CWE-306: Una vulnerabilidad de Falta de Autenticación para Funciones Criti... • https://www.schneider-electric.com/en/download/document/SEVD-2019-134-02 • CWE-306: Missing Authentication for Critical Function •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-7823
https://notcve.org/view.php?id=CVE-2018-7823
22 May 2019 — A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine Basic when sending crafted ethernet message. Existe una vulnerabilidad de entorno (CWE-2) en SoMachine Basic, todas las versiones y Modicon M221 (todas las referencias, todas las versiones anteriores al firmware V1.10.0.0), que podría generar el inicio remoto de SoMachine Basic cuando se envía un mensaje Ethernet ... • https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-7822
https://notcve.org/view.php?id=CVE-2018-7822
22 May 2019 — An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause unauthorized access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic. Existe una vulnerabilidad de permisos predeterminados incorrectos (CWE-276) en SoMachine Basic, todas las versiones, y Modicon M221 (todas las referencias, todas las versiones anteriores al firmware V1.10.0.0), que p... • https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01 • CWE-276: Incorrect Default Permissions •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2018-7821
https://notcve.org/view.php?id=CVE-2018-7821
22 May 2019 — An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when flooding the M221 ethernet interface while the Ethernet/IP adapter is activated. Existe una vulnerabilidad de entorno (CWE-2) en SoMachine Basic, todas las versiones, y Modicon M221 (todas las referencias, todas las versiones anteriores al firmware V1.10.0.0), que podría generar un impacto en el tiempo del ciclo al i... • https://www.schneider-electric.com/en/download/document/SEVD-2019-045-01 • CWE-770: Allocation of Resources Without Limits or Throttling •